sonarqube-scanner
Advanced tools
Comparing version 3.5.0 to 4.0.0
{ | ||
"name": "sonarqube-scanner", | ||
"description": "SonarQube/SonarCloud Scanner for the JavaScript world", | ||
"version": "3.5.0", | ||
"version": "4.0.0", | ||
"homepage": "https://github.com/SonarSource/sonar-scanner-npm", | ||
@@ -18,22 +18,34 @@ "author": { | ||
"license": "LGPL-3.0-only", | ||
"main": "src/index.js", | ||
"main": "build/src/index.js", | ||
"types": "build/src/index.d.ts", | ||
"bin": { | ||
"sonar-scanner": "src/bin/sonar-scanner" | ||
"sonar-scanner": "bin/sonar-scanner" | ||
}, | ||
"engines": { | ||
"node": ">= 16" | ||
"node": ">= 18" | ||
}, | ||
"dependencies": { | ||
"adm-zip": "0.5.12", | ||
"fancy-log": "2.0.0", | ||
"https-proxy-agent": "7.0.4", | ||
"axios": "1.6.8", | ||
"commander": "12.0.0", | ||
"fs-extra": "11.2.0", | ||
"hpagent": "1.2.0", | ||
"jest-sonar-reporter": "2.0.0", | ||
"mkdirp": "3.0.1", | ||
"node-downloader-helper": "2.1.9", | ||
"progress": "2.0.3", | ||
"slugify": "1.6.6" | ||
"node-forge": "^1.3.1", | ||
"proxy-from-env": "^1.1.0", | ||
"semver": "7.6.0", | ||
"slugify": "1.6.6", | ||
"tar-stream": "3.1.7" | ||
}, | ||
"devDependencies": { | ||
"@types/adm-zip": "0.5.5", | ||
"@types/fs-extra": "11.0.4", | ||
"@types/jest": "29.5.12", | ||
"@types/node-forge": "^1.3.11", | ||
"@types/proxy-from-env": "1.0.4", | ||
"@types/semver": "7.5.8", | ||
"@types/sinon": "17.0.3", | ||
"@types/tar-stream": "3.1.3", | ||
"@typescript-eslint/parser": "7.4.0", | ||
"axios-mock-adapter": "1.22.0", | ||
"chai": "4.4.1", | ||
@@ -48,2 +60,3 @@ "eslint": "8.57.0", | ||
"sinon": "17.0.1", | ||
"ts-jest": "29.1.2", | ||
"typescript": "5.4.3" | ||
@@ -60,4 +73,5 @@ }, | ||
"scripts": { | ||
"build": "npm ci && npm run check-format && npm run license && npm test && cd tools/orchestrator && npm run build", | ||
"test": "npx jest --coverage", | ||
"build": "npm ci && npm run ts-build && npm run check-format && npm run license && npm test && cd tools/orchestrator && npm run build", | ||
"ts-build": "tsc && node scripts/fix-comments.js", | ||
"test": "jest --coverage", | ||
"test-integration": "cd test/integration && npm test", | ||
@@ -78,4 +92,5 @@ "format": "prettier --write .", | ||
"files": [ | ||
"src/**" | ||
"build/**", | ||
"bin/**" | ||
] | ||
} |
@@ -11,6 +11,10 @@ # NPM module to run SonarQube/SonarCloud analyses | ||
This is the documentation for v4. If you are using v3, refer to [the v3 documentation](https://github.com/SonarSource/sonar-scanner-npm/tree/37797347a30635647da5a45ed912a9ae77405b85). | ||
## Installation | ||
_Prerequisite: Node v16+ (otherwise use sonarqube-scanner v2.9.1)_ | ||
_Prerequisite: Node v18+ (for v4 and above)_ | ||
_Prerequisite: Node v16+ (for v3, otherwise use sonarqube-scanner v2.9.1)_ | ||
This package is available on npm as: `sonarqube-scanner` | ||
@@ -38,3 +42,3 @@ | ||
```javascript | ||
const scanner = require('sonarqube-scanner'); | ||
const scanner = require('sonarqube-scanner').default; | ||
@@ -44,3 +48,3 @@ scanner( | ||
serverUrl: 'https://sonarqube.mycompany.com', | ||
token: '019d1e2e04eefdcd0caee1468f39a45e69d33d3f', // use "login" for SQ up to version 9 | ||
token: '019d1e2e04eefdcd0caee1468f39a45e69d33d3f', | ||
options: { | ||
@@ -53,3 +57,8 @@ 'sonar.projectName': 'My App', | ||
}, | ||
() => process.exit(), | ||
error => { | ||
if (error) { | ||
console.error(error); | ||
} | ||
process.exit(); | ||
}, | ||
); | ||
@@ -63,6 +72,4 @@ ``` | ||
- `parameters` _Map_ | ||
- `serverUrl` _String_ (optional) The URL of the SonarQube server. Defaults to http://localhost:9000 | ||
- `login` _String_ (optional) The login used to connect to the SonarQube server up to version 9. Empty by default. | ||
- `serverUrl` _String_ (optional) The URL of the SonarQube server. Defaults to https://sonarcloud.io | ||
- `token` _String_ (optional) The token used to connect to the SonarQube server v10+ or SonarCloud. Empty by default. | ||
- `caPath` _String_ (optional) the path to a CA to pass as `https.request()` [options](https://nodejs.org/api/https.html#https_https_request_options_callback). | ||
- `options` _Map_ (optional) Used to pass extra parameters for the analysis. See the [official documentation](http://redirect.sonarsource.com/doc/analysis-parameters.html) for more details. | ||
@@ -108,3 +115,3 @@ - `callback` _Function_ (optional) | ||
You can install manually the [standard SonarScanner](https://redirect.sonarsource.com/doc/install-configure-scanner.html), | ||
You can install manually the [standard SonarScanner](https://docs.sonarsource.com/sonarqube/latest/analyzing-source-code/scanners/sonarscanner/), | ||
which requires to have a Java Runtime Environment available too (Java 8+). | ||
@@ -134,3 +141,3 @@ | ||
## Download From Mirrors | ||
## Download From Mirrors (SQ < 10.6 only) | ||
@@ -166,3 +173,3 @@ By default, the scanner binaries are downloaded from `https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/`. | ||
By default, the scanner binaries are cached into `$HOME/.sonar/native-sonar-scanner` folder. | ||
To use a custom cache fodler instead of `$HOME`, set `$SONAR_BINARY_CACHE`. | ||
To use a custom cache folder instead of `$HOME`, set `$SONAR_BINARY_CACHE`. | ||
@@ -169,0 +176,0 @@ **Example:** |
License Policy Violation
LicenseThis package is not allowed per your license policy. Review the package's license to ensure compliance.
Found 1 instance in 1 package
Empty package
Supply chain riskPackage does not contain any code. It may be removed, is name squatting, or the result of a faulty package publish.
Found 1 instance in 1 package
Major refactor
Supply chain riskPackage has recently undergone a major refactor. It may be unstable or indicate significant internal changes. Use caution when updating to versions that include significant changes.
Found 1 instance in 1 package
Copyleft License
License(Experimental) Copyleft license information was found.
Found 1 instance in 1 package
Mixed license
License(Experimental) Package contains multiple licenses.
Found 1 instance in 1 package
Non-permissive License
License(Experimental) A license not known to be considered permissive was found.
Found 1 instance in 1 package
License Policy Violation
LicenseThis package is not allowed per your license policy. Review the package's license to ensure compliance.
Found 1 instance in 1 package
Network access
Supply chain riskThis module accesses the network.
Found 1 instance in 1 package
Shell access
Supply chain riskThis module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.
Found 1 instance in 1 package
Copyleft License
License(Experimental) Copyleft license information was found.
Found 1 instance in 1 package
Environment variable access
Supply chain riskPackage accesses environment variables, which may be a sign of credential stuffing or data theft.
Found 3 instances in 1 package
Filesystem access
Supply chain riskAccesses the file system, and could potentially read sensitive data.
Found 1 instance in 1 package
Mixed license
License(Experimental) Package contains multiple licenses.
Found 1 instance in 1 package
Non-permissive License
License(Experimental) A license not known to be considered permissive was found.
Found 1 instance in 1 package
207
0
2
18606
11
21
4
0
+ Addedaxios@1.6.8
+ Addedcommander@12.0.0
+ Addedfs-extra@11.2.0
+ Addedhpagent@1.2.0
+ Addednode-forge@^1.3.1
+ Addedproxy-from-env@^1.1.0
+ Addedsemver@7.6.0
+ Addedtar-stream@3.1.7
+ Addedasynckit@0.4.0(transitive)
+ Addedaxios@1.6.8(transitive)
+ Addedb4a@1.6.7(transitive)
+ Addedbare-events@2.5.0(transitive)
+ Addedcombined-stream@1.0.8(transitive)
+ Addedcommander@12.0.0(transitive)
+ Addeddelayed-stream@1.0.0(transitive)
+ Addedfast-fifo@1.3.2(transitive)
+ Addedfollow-redirects@1.15.9(transitive)
+ Addedform-data@4.0.1(transitive)
+ Addedfs-extra@11.2.0(transitive)
+ Addedgraceful-fs@4.2.11(transitive)
+ Addedhpagent@1.2.0(transitive)
+ Addedjsonfile@6.1.0(transitive)
+ Addedlru-cache@6.0.0(transitive)
+ Addedmime-db@1.52.0(transitive)
+ Addedmime-types@2.1.35(transitive)
+ Addednode-forge@1.3.1(transitive)
+ Addedproxy-from-env@1.1.0(transitive)
+ Addedqueue-tick@1.0.1(transitive)
+ Addedsemver@7.6.0(transitive)
+ Addedstreamx@2.20.2(transitive)
+ Addedtar-stream@3.1.7(transitive)
+ Addedtext-decoder@1.2.1(transitive)
+ Addeduniversalify@2.0.1(transitive)
+ Addedyallist@4.0.0(transitive)
- Removedfancy-log@2.0.0
- Removedhttps-proxy-agent@7.0.4
- Removedmkdirp@3.0.1
- Removednode-downloader-helper@2.1.9
- Removedprogress@2.0.3
- Removedagent-base@7.1.1(transitive)
- Removedcolor-support@1.1.3(transitive)
- Removeddebug@4.3.7(transitive)
- Removedfancy-log@2.0.0(transitive)
- Removedhttps-proxy-agent@7.0.4(transitive)
- Removedmkdirp@3.0.1(transitive)
- Removedms@2.1.3(transitive)
- Removednode-downloader-helper@2.1.9(transitive)
- Removedprogress@2.0.3(transitive)